   [client-id secret]
   (find-by-key [client-id "refresh" secret]))
 
-(defn find-grant-token
+(defn find-granted-token
   [client-id login]
-  (find-by-key [client-id "grant" login]))
+  (find-by-key [client-id "login" login]))
 
 (defn purge-tokens
   []


    (if (f/failed? access-token)
      access-token
      (let [refresh-token (or (find-grant-token (:id client) (:login user))
                              (create-token client user scope {:refreshing secret}))]

        (-> {:access_token secret

                   :created-at (java.util.Date.)
                   :tag (if refreshing "refresh" "access")})]

    ;; refresh tokens are "aliased" as "login" in no-sql databases. they're reachable
    ;; by user's login and allow to avoid multiple refresh-tokens per client-user pair.

    (when refreshing
      (store! *token-store* [:client-id :tag :login] (assoc token :tag "login")))

    (if-let [result (store! *token-store* [:client-id :tag :secret] token)]
      (map->Token result)
